Joe, a technician at the local power plant, notices that several turbines had ramp up in cycles during the week. Further investigation by the system engineering team determined that a timed .exe…

Creating a dedicated VLAN for the SCADA network segments it from the rest of the corporate network, which would prevent the type of access the contractors exploited to upload malicious files to the system control console. VLAN segmentation enforces access control boundaries so that only authorized systems can communicate with industrial control equipment. This is a foundational ICS security control recommended by NIST and ICS-CERT to protect operational technology from IT network threats.

Enabling PKI for the mainframe addresses certificate-based authentication but does not isolate the SCADA network from external access or prevent unauthorized file uploads via physical or network access.

Patch management would address software vulnerabilities but does not prevent the network-level access that allowed contractors to upload the malicious executable to the control console.

Implementing WPA2 wireless security addresses wireless authentication but is irrelevant if the malware was uploaded through a wired connection or physical console access during the contractors' visit.